Allow only members of approved security groups to share externally

Description

Only members of the security groups {{ external_sharing_groups }} can share SharePoint and OneDrive content with guests. In the SharePoint admin center this is Allow only users in specific security groups to share externally; the groups are stored in WhoCanShareAuthenticatedGuestAllowList (and WhoCanShareAnonymousAllowList if Anyone links are allowed). Other users can still share inside the organization.

Rationale

Most users never need to share outside the organization. Restricting the right to named groups reduces the number of accounts that can exfiltrate content by sharing, makes the remaining external sharing reviewable through group membership, and limits what a compromised ordinary account can expose.

Impact

Users outside the groups get an error when they try to share with an external address and must ask a group member or request membership. Plan the request process and the group owners. The list only accepts security groups (not Microsoft 365 groups). Guests already added to a team or site keep their access.

Setting

Parameters

The value used is your override (tailoring file), else the profile's, else the one of the profile it extends, else the default. Bounds limit what an override may set.

Audit

1. Sign in to the SharePoint admin center (https://admin.microsoft.com/sharepoint) as at least a Global Reader.
2. Browse to Policies > Sharing > More external sharing settings.
3. Check that Allow only users in specific security groups to share externally is selected and that Manage security groups lists only {{ external_sharing_groups }}.
4. With the SharePoint Online Management Shell (SharePoint Administrator): Get-SPOTenant | Select-Object WhoCanShareAuthenticatedGuestAllowList, WhoCanShareAnonymousAllowList and resolve the GUIDs in Entra.
5. Fail if external sharing is allowed and the restriction is off, or if a group outside the approved list is present.

Remediation

1. Create (or reuse) a security group for the people allowed to share externally, with an owner who approves membership. Optionally review it with an access review.
2. In the SharePoint admin center, browse to Policies > Sharing > More external sharing settings, select Allow only users in specific security groups to share externally, then Manage security groups, add the groups and choose Can share with authenticated guests. Select Save. Role: SharePoint Administrator.
3. PowerShell equivalent: Set-SPOTenant -WhoCanShareAuthenticatedGuestAllowList "<group object ID>" (comma-separated object IDs).

Rollback

Clear Allow only users in specific security groups to share externally, or add the missing group.

References

• Manage security groups for external sharing Microsoft, vendor-doc, accessed 2026-10-24
• Manage sharing settings for SharePoint and OneDrive in Microsoft 365 Microsoft, vendor-doc, accessed 2026-10-24
• Set-SPOTenant (SharePoint Online Management Shell) Microsoft, vendor-doc, accessed 2026-10-24
• CISA SCuBA Microsoft SharePoint Online and OneDrive baseline CISA, standard, accessed 2026-10-24

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

Related controls

• related CB-M365-COLLAB-003 Restrict SharePoint external sharing to authenticated guests
• related CB-M365-COLLAB-005 Limit SharePoint and OneDrive external sharing to approved domains

People and lifecycle